Scopes
Keys are scoped — a key that reads call logs cannot place calls. The full list, along with how to create, rotate and revoke keys, is on API keys.There is no admin scope, and one cannot be created. Anything an administrator can
do is unreachable from an API key by construction, not by a permission check that
could be misconfigured.
Live and test keys
Keys carry awv_live_ or wv_test_ prefix, so a test key pasted into
production fails loudly instead of quietly operating on real data.
Rotation
POST /v1/api-keys/{id}/rotate issues a replacement and keeps the old key
working for 24 hours. A deploy is never caught in a window where neither key
is valid.
Revocation (DELETE) is immediate, with no grace — that is what you reach for
when a key has leaked.
Versioning
The/v1 prefix covers additive changes. Anything that changes behaviour ships
behind a dated Wixzel-Version header, and an existing key keeps the behaviour
it was created with.